Download WebMux 481S/591SG Load Balancer 8.1.xx PDF

Table of Contents
Table of Contents··························································································································································· i
Packing List································································································································································· iii
Main Components························································································································································· 1
Front View ······························································································································································ 1
Rear View ······························································································································································· 2
WebMux™ Overview··················································································································································· 3
Key Features···························································································································································· 3
The WebMux™ Family··········································································································································· 5
Network Overview ·················································································································································· 7
Sample Configurations ················································································································································10
Single WebMux™··················································································································································10
Redundant Installation ············································································································································12
Installation without IP Address Change (OOP) ·······································································································14
Installation without IP Address Change (TM) ·········································································································16
Before you Start······················································································································································18
Hardware Setup --- Collect Information··················································································································19
Hardware Setup ---Setup the new network··············································································································19
Hardware Setup ---Configuration Summary············································································································20
Initial Configuration ····················································································································································20
NAT Mode Related Configuration··························································································································22
Trasnparent Mode Related Configuration ···············································································································23
Out-of-Path Related Configuration ·························································································································25
Common Configuration ··········································································································································26
-For NAT, Transparent (Bridge), and Out-of-Path Mode ························································································26
What if I made mistake in my configuration?··········································································································29
Management Console ··················································································································································30
Login······································································································································································31
Main Management Console ····································································································································33
Download/Upload ··················································································································································34
Change Password ···················································································································································41
Change PIN ····························································································································································42
Add Farm ·······························································································································································45
SSL Keys ·······························································································································································47
Upload/Download ··················································································································································51
More about Add Farm ············································································································································53
Modify Farm····························································································································································58
Add Server ·····························································································································································60
i
Add L7 Server ························································································································································62
Modify Server ························································································································································65
Initial setup change Through Browser·····················································································································67
Initial Configuration Worksheets ·································································································································69
Sample Configuration Worksheets·······························································································································70
Standalone WebMux™ NAT Mode························································································································70
Standalone WebMux™ Transparent Mode ·············································································································71
Out of Path Installation of WebMux™ ···················································································································72
A Redundant Installation··········································································································································74
Contact Information·····················································································································································75
FAQs···········································································································································································76
Regulations··································································································································································79
Appendix 1 – How to Add A Loopback Adapter··········································································································80
Appendix 2 - How to make route delete reboot persistent·····························································································82
Appendix 3 - Phone Paging Codes ·······························································································································83
Appendix 4 – Virtual Hosting Issues····························································································································85
Appendix 5 – Sample Custom CGI Code ·····················································································································86
Appendix 6 – Access CLI Commands··························································································································87
Appendix 7 – Extended Regular Expressions ···············································································································88
Index ···········································································································································································89
ii
Packing List
•
One (1) WebMux™ unit
•
One (1) Power cord
•
One (1) User Manual
•
One (1) Warranty registration card
iii
iv
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Main Components
Front View
Toggle Power Switch
This switch toggles power on and off. To power off, the switch must be pressed
and held for 5 seconds.
Reset Button
Press and release the reset button to reset the WebMux™. This process may
take several minutes to complete.
Up Arrow Button, Down Arrow Button
When each button is pressed, the value on the cursor location increases or
decreases. It goes through lower case letters, upper case letters, numbers and
symbols. When the cursor is located at the left most position on the LCD, the up
and down arrow allows the user to select a different item to setup.
Left Arrow Button and Right Arrow Button
When each button is pressed, the cursor moves to the left and right.
Check Mark Button, and Cross Button
Check Mark Button confirms the selection, Cross Button cancels the selection. At
any time when the system is running holding down to the Check Mark Button will
invoke the configuration menu, where you can change IP addresses and other
settings.
Copyright© 1997-2006 CAI Networks, Inc.
1
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Rear View
Server LAN Port
Connect this port to the Server LAN switch or hub. This port connects to the
servers and your local computers. It is the right most RJ45 socket. In Out-of Path
configuration, this is the only Ethernet cable to be connected.
Backup WebMux™ Port
Optionally, you may connect another WebMux™ to this port so that you can have
redundancy. If you have more than one WebMux™ , you can connect them using
a cross over cable, or a regular cable with a hub.
Router LAN Port
Connect this port to the Router LAN switch or hub. In most situations, this port
connects to the Internet side network in NAT mode. It is the left most RJ45
Socket.
PLEASE NOTE: The Router LAN and Server LAN port are not interchangeable.
External Modem Connect Port
To utilize the phone pager function of the WebMux™, please connect the
external modem to this port. In some cases, if you prefer support engineers to
not use diagnostic ports over the Internet, our support engineers can also
connect through the modem to assist you with setup issues. A US Robotics
V.Everything modem is required: US Robotics part number 3CP3453. Modem dip
switch has 3, 8, and 10 down, rest up. A standard external modem cable is also
needed. Check with your modem supplier for the cable.
Power Switch
This switches the WebMux™ on and off. When in the "off" position, the front
panel power switch is disabled.
Power Cord
Please use the supplied power cord to connect the WebMux™ to the power
source. 1U WebMux™ has a 115V/230V AC universal power supply.
2 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
WebMux™ Overview
Key Features
The WebMux™ is a standalone network appliance designed primarily to load
balance IP traffic to multiple servers. The WebMux™ includes the following key
features.
•
Improves performance by distributing the traffic for a site or domain
among multiple servers. No one server will be bogged down trying to
service a particular site.
•
SSL Termination to reduce the cost of multiple certificates.
•
Provides high availability by tracking which servers are functioning
properly and which servers are out of service. If a server unexpectedly
goes down, the WebMux™ will automatically re-direct the traffic to other
servers, or will bring a standby or backup server online to service the
traffic. The WebMux ™ does application level health check to many
network protocols on servers.
•
Provides Persistent Connections by memorizing the user browser
session and the server session and sending the same user to the same
server. This is important for sites using shopping cart and dynamically
generated pages, like BroadVision, ASP and JSP sites.
•
Provides fault tolerance. This installation requires two WebMuxes, a
primary and a secondary. The two WebMuxes will automatically sync the
configuration datum.
•
Easy management. It can be managed via a secured web browser
session from anywhere in the world. By using https 128 bit encryption to
the management web console, secure remote management of server
farms is truly possible.
•
Operating System independent. No software or agent to load on the
servers. Non-intrusive load/failure detection and management.
•
Provides Proxy function. When communication is initiated from behind
the WebMux™, the WebMux™ will substitute its own address for the
internal address. This allows the web servers to initiate communication for
Copyright© 1997-2006 CAI Networks, Inc.
3
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
services such as credit card validation and mapping services. (Note: this
function only works in NAT mode).
•
Built-in Firewall Protections (layer4/5 only). Stop possible hacker
intrusion into your network from Internet. All IP addresses and ports are
blocked except the farm IP address. Built-in functions will detect any
possible denial of service attack and make your services always available.
(Note: this function only works in NAT mode with “Forwarding Deny”, see
setup for details).
•
In-Path or Out-of-Path Load Balancing. In normal setup, the WebMux™
can be configured In-Path, to act as firewall in addition to the load balancer
and health checker. However, if outbound traffic is much larger than
inbound traffic and you already have a firewall in place, or change of IP
address causes problems, consider using Out-of-Path configuration. Outof-Path load balancing is also called direct routing, or one leg operation.
•
Transparent Mode. In this mode, the WebMux™ behaves as an Ethernet
bridge between the servers and the Router LAN. The main advantage is
that the network settings in the servers do not have to be changed, no
loopback adapters or IP address changes needed. The servers will be
connected behind the WebMux™ but will appear to be on the same LAN
that the WebMux™ is connected to.
•
Layer 7 Load Balancing. WebMux™ can direct traffic to specific groups
of servers within a farm according to a match pattern in HTTP MIME
header. This allows you, for example, to group servers that serve only a
specific type of content while serving other types of content on another
group of servers. WebMux™ Layer 7 load balancing also includes URI
load directing with host name MIME header matching and cookies in order
to memorize the user browser session and the server session and send the
same user to the same server. This is important for sites using shopping
cart and dynamically generated pages.
•
Informs you of the status of your network. It provides phone pager
and email notification so that the network administrator can be paged or
emailed whenever a server or WebMux™ goes down, and when it returns
online. This feature could reduce server room night shift operator costs, or
timely repair should the server goes down unexpectedly.
4 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
The WebMux™ Family
The 1U WebMux™ family consists of three models. They are:
•
•
•
The WebMux™ 481S
The WebMux™ 591SG
The WebMux™ 680SP
The table below compares the features of the models.
Model Number:
481S
591SG
680SP
Maximum concurrent connections
1,440,000*
2,880,000*
5,760,000*
Maximum transactions per second
15,000
50,000
100,000
200 MBits
1GBits
4GBits
Layer 4 Performance
Maximum throughput per second
Maximum Internet link speed
2 X T3
1.5 X OC-12 1.5 X OC-12
Layer 7 & SSL Acceleration
120
250
1200**
2400***
2000
3000***
Max. Layer 7 connections/s
10,000
30,000
50,000
Number of SSL certificates
16
16
16
Cookie content based
Yes
Yes
Yes
URL based
Yes
Yes
Yes
Round-robin
Yes
Yes
Yes
Persistent round-robin
Yes
Yes
Yes
Weighted round-robin
Yes
Yes
Yes
Persistent weighted round-robin
Yes
Yes
Yes
Least connections
Yes
Yes
Yes
Persistent least connections
Yes
Yes
Yes
Weighted least connections
Yes
Yes
Yes
Persistent weighted least connections
Yes
Yes
Yes
URL based content switch
Yes
Yes
Yes
Cookie based content switch
Yes
Yes
Yes
Diskless Design
Yes
Yes
Yes
Port aggregation
Yes
Yes
Yes
Optional
Optional
Optional
Yes
Yes
Yes
Max. 1024bit RSA
terminations/second (round trip)
Load Balancing Methods
Traffic Management Methods
Fault Tolerance
Failover via network connection
Failover via Ethernet link
Copyright© 1997-2006 CAI Networks, Inc.
5
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Service aware
Yes
Yes
Yes
Server aware
Yes
Yes
Yes
Backup server
Yes
Yes
Yes
Network Address Translation (NAT)
Yes
Yes
Yes
TCP SYN protection
Yes
Yes
Yes
Address mapping
Yes
Yes
Yes
Port mapping
Yes
Yes
Yes
TCP DoS protection
Yes
Yes
Yes
HTTPS/SSH management
Yes
Yes
Yes
Ethernet / Fast Ethernet
Yes
Yes
Yes
GB Ethernet (1000Base-TX)
Yes
Yes
Yes
Rackmount 1U form factor
Yes
Yes
Yes
Interface to switches
Gigabit x2
Gigabit x2
Gigabit x2
Maximum virtual servers
Unlimited
Unlimited
Unlimited
65,532
65,532
65,532
Security
Topologies
Device Support
Maximum real servers
Device's role in the network
UDP-based service support
Bridge/router Bridge/router Bridge/router
Yes
Yes
Yes
Secure web browser access
Yes
Yes
Yes
In service / Not in service
Yes
Yes
Yes
Phone / pager alarm notification
(ext modem req)
Yes
Yes
Yes
Email Notification
Yes
Yes
Yes
Configuration access
Yes
Yes
Yes
Remote telnet/SSH access
Yes
Yes
Yes
Persistent connections
Yes
Yes
Yes
Port-specific services
Yes
Yes
Yes
Factory warranty
3 years
3 years
3 years
Free telephone and email support
3 years
3 years
3 years
Yes
Yes
Yes
Overnight pre-sent exchange unit
Optional
Optional
Optional
24x7 Gold Premium Support
Optional
Optional
Optional
Yes
Yes
Yes
Management
Miscellaneous
Free factory pre-configuration
30-day money-back guarantee
* NAT (in-path) mode. Much higher performance in Out-Of-Path mode
** With CAI-RSA3500 option card
*** With CAI-RSA7000 option card
6 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Network Overview
The WebMux™ has three modes: In-Path, or NAT (Network Address Translation),
Out-of-Path mode, and Transparent (NAT Ethernet Bridge) Mode. Each mode
has its advantage and disadvantages. Lets look the NAT mode first.
The main purpose of the WebMux™ is to balance the traffic among multiple web
or other servers. The diagram above shows an NAT installation with two
WebMuxes. In this configuration, one WebMux™ is serving as the primary, and
the other is serving as the secondary, or backup, providing a fault tolerant
solution.
In order for the web servers to share the incoming traffic, the WebMux™ must be
connected to the network. There are two interfaces on the WebMux™. One
interface (Internet) connects to the Router LAN. This is the network to which the
Internet router is connected. The other interface (server) is connected to the
Server LAN. This network connects all the web servers. The WebMux™ routes
traffic between these two networks.
Next, a Virtual Farm or multiple farms must be configured on the WebMux™. A
virtual farm is a single representation of the servers to the clients. A farm consists
Copyright© 1997-2006 CAI Networks, Inc.
7
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
of a group of servers that service the same domain, website or services. For
example, to configure a farm (or virtual farm) to serve www.cainetworks.com:
•
First, Server 1 and Server 2 would each need the website
www.cainetworks.com configured on them and HTTP/HTTPS services
started, and
•
Second, a farm on the WebMux™ is defined with Server 1 and Server 2 in
it. The servers would be setup to either share the traffic, or setup as a
primary server and standby server. In either case, if Server 1 goes down,
then all traffic will be automatically directed to Server 2 by the WebMux™ .
In Out-of-Path mode, only one network in the setup, that is the server LAN, is
connected to the Internet through the firewall and router. Internet traffic or local
connections can both be directly sent to the WebMux ™ , which routes the
packets to the proper server(s), then the server routes the return traffic back to
the remote or local clients directly.
In most situations, the incoming traffic is in small requests, and return traffic from
servers back to clients is large amount of data, pictures, or documents. Using outof-path mode will allow up to 100 times more traffic to be handled by the
8 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
WebMux™ load balancer. The disadvantage for direct routing is that the firewall
protections built-in to the WebMux™ will no longer function. Users then must
provide their own firewall for incoming and outgoing traffic.
Copyright© 1997-2006 CAI Networks, Inc.
9
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Sample Configurations
Single WebMux™
•
This installation requires one WebMux™.
•
One WebMux™ interface (Internet) connects to the Router LAN.
other interface connects to the Server LAN.
•
The WebMux™ translates the Router LAN IP addresses to an internal
non-routable class-C address.
In this example, the netmask is
255.555.255.0. The IP address of the WebMux™ interface on the Router
LAN is 205.133.156.220. The IP address of the WebMux™ interface
attached to the Server LAN is 192.168.199.251.
•
The Default Gateway for all the servers is 192.168.199.1.
•
Farm 1 IP address is 205.133.156.200. Servers 1 and 2 serve Farm 1.
10 Copyright© 1997-2006 CAI Networks, Inc.
The
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
•
Farm 2 IP address is 205.133.156.210. Servers 2 and 3 serve Farm 2.
•
Changes to the server: change the default gateway to 192.168.199.1, as
well as the IP address to the 192.168.199.xxx address. If on the server
there is a service attached to the IP address (HTTP/S, FTP, etc), please
make sure the service will run on the new IP address.
NOTE: Although the WebMux™ can work with any IP address range, all server IP addresses
should be Internet non-routable address so that the source address from the Internet does not
conflict with the IP addresses on the Server LAN.
NOTE: If there is a firewall between the WebMux™ and the Internet Router, a rule must be
defined in the firewall to allow the IP address of the WebMux™ interface on the Router LAN along
with the farm IP address to communicate out to the Internet on all ports. If you are doing Network
Address Translation of the farm address to a non-routable address, then both the farm address
and the WebMux™ interface address must be translated to communicate outbound on all ports.
Copyright© 1997-2006 CAI Networks, Inc.
11
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Redundant Installation
•
The installation requires two WebMuxes. One will be the primary, and the
other the secondary. They connect together with the Ethernet cable that
is either cross-over or through a hub. The primary redundant interface IP
address is 192.168.255.253; the secondary redundant interface IP
address is 192.168.255.254. They can not be changed.
•
Both WebMuxes connect to the Router LAN, and to the Server LAN. Each
WebMux™ interface has a unique IP address.
•
The registered Internet IP address range is a class C address range.
•
The IP address of the WebMuxes’ Virtual Farms must be in the same
network range as the Internet router.
•
The WebMux™ translates the Router LAN IP addresses to an internal
non-routable class A address. In this example, the subnet-mask is
12 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
255.0.0.0. The IP address of the WebMux™ interfaces attached to the
Server LAN are 10.1.1.10 and 10.1.1.20.
•
The Default Gateway for all the servers is 10.1.1.1.
•
Farm 1 IP address is 205.133.156.200.
•
Servers 1 and 2 serve Farm 1.
•
Farm 2 IP address is 205.133.156.210.
•
Servers 2 and 3 serve Farm 2.
•
Changes to the servers: change default the gateway to 10.1.1.1, as well
as the IP addresses to the 10.3.1.10/20/30 addresses. If on the server
there is a service attached to the IP address (HTTP/S, FTP, etc), please
make sure the service will run on the new IP address.
NOTE: Although the WebMux™ can work with any IP address range, all server IP addresses
should be Internet non-routable address so that the source address from the Internet does
not conflict with the IP addresses on the Server LAN.
NOTE: If there is a firewall between the WebMux™ and the Internet Router, a rule must be
defined in the firewall to allow the IP address of the WebMux™ interfaces on the Router LAN
in addition to the farm IP address (could be same as the WebMux™ Router LAN IP address)
to communicate out to the Internet on all ports. Since the WebMux™ doing Network Address
Translation of the farm address to a non-routable address, the farm addresses on the
WebMux™ interface must communicate outbound on all ports defined in the farms.
Copyright© 1997-2006 CAI Networks, Inc.
13
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Installation without IP Address Change (OOP)
Out-of-Path Mode:
The above diagram is an example about how to configure the WebMux™ in outof-path mode without changing the IP addresses of the web servers and other
servers that already exist on the network. This is particularly helpful when the
changing of an existing network of servers causes problems.
In this configuration, all the servers still remain on the same IP network and can
communicate. From the servers “view”, the WebMux™ is on the same network
as the servers. On the WebMux™ , only the server LAN cable is connected,
since there is only one network in direct routing mode. The WebMux™ takes at
least two IP addresses to work in this mode, server LAN Interface IP address and
farm IP address.
Out-of-path mode also allows two WebMuxes to fully backup each other. The two
WebMuxes are connected to each other through a cross-over Ethernet cable.
Two simple changes must be made to each server in the farm. 1) Have a new
loopback adapter installed and have its address set to the farm address. Do not
set the gateway on the loopback adapter. Please refer to Appendix 1 and
Appendix 2 for how to configure a loopback adapter, as well as how to remove
14 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
the route from the servers. Please note for Out-of-Path to work properly, the
loopback adapter must route the return traffic through the real network
interface. In other words, the loopback adapter cannot have the gateway
specified. Please refer to Appendix 1 and 2 for more details on how to
configure the loopback adapter on servers. In case the server is running
Windows 2003, the route created during adding loopback adapter cannot
be deleted; please make sure the loopback adapter has much higher metric.
2) If your service is bind to any specific IP address, add the loopback adapter’s
IP address to that service.
The firewall configuration must be changed to point to the new farm address on
the WebMux™ . Since the WebMux™ always uses one IP address in the server
LAN, the farm address must be a different IP address in the server LAN in Outof-Path mode.
NOTE: Under normal Out-of-Path operations, you will only need to set the external gateway IP
address for the WebMux ™ . However, if you are going to have the WebMux ™ do SSL
termination or Layer 7 load balancing, you must set a server LAN gateway IP in the WebMux™
and have the servers’ default gateway point to that IP address.
Copyright© 1997-2006 CAI Networks, Inc.
15
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Installation without IP Address Change (TM)
Transparent Mode:
Transparent Mode is another WebMux™ configuration that allows you to keep
the existing IP addresses of your servers. Like Out-of-Path mode, the servers
and the WebMux™ will be on the same IP network. However, physically, the
servers will be connected to the WebMux™ in the same way they would be for
NAT mode, on the server LAN port. The “internet” port on the WebMux™ is
connected towards the Firewall/Router. In this mode, the WebMux™ functions
as an Ethernet bridge. Anything connected to its back interface (server LAN) is
on the same network as its front interface (internet/router LAN). If you look at the
diagram above, you will see that the terminals are on the same network as the
servers, even though the servers are “behind” the WebMux™ . The terminals can
communicate with the servers IP directly as if the WebMux™ was not there, and
vise versa.
16 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
When creating a farm, choose a unique farm IP address in the network, and then
add the server IP address under that farm. Load balancing occurs when the
“Farm IP” is accessed instead of the servers’ actual IP.
There are no configuration changes that need to be made on the servers, only
the way they are physically connected to the network.
The diagram also gives an example of a redundant WebMux™ setup. In this
case, it is absolutely required that the WebMuxes™ are connected in between
two switches that have Spanning Tree Protocol (STP) enabled. STP controls the
path where packets go in the existence of redundant Ethernet bridges according
to bridge priority so that loops do no occur. Without this, packets will loop
endlessly between the WebMuxes™ and saturate their network path.
During a failover situation, you may immediately notice that the backup becomes
unreachable even though the LCD shows that it is active. This is a temporary
situation as the switches detect new bridge priorities. This failover time usually
takes about 15-30 seconds. This also happens when the primary comes back
online and the secondary returns back to standby mode.
For single WebMux setup, any kind of switch will work, since there is only one
bridge path exist on the network. No Spanning Tree Protocol is required.
Copyright© 1997-2006 CAI Networks, Inc.
17
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Configuring the WebMux™
Before you Start
Please collect the information about names and IP addresses designated by the
arrows in the network topology below.
Network Terminology
A Virtual Farm includes the WebMux™ setup and the servers under it.
Functionally, it acts as a single unit on a network.
For example,
http://www.you.com is one virtual server farm; https://www.me.com is another
farm, and ftp://ftp.cainetworks.com is the third farm. The first farm works on a set
of servers on port 80, the second farm consists of another set of servers on port
443, and the third farm works on a set of servers on port 21. Please note that the
WebMux™ does support combining 80/443 ports as one single farm, so that
same client browsing the site in HTTP mode will be send to the same server for
HTTPS requests. In the combined mode, ports 80/443 will be combined into one
farm.
18 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
To serve the Internet, there must be at least one Internet Router. This local
area network that connects the router and the WebMux™ is called the Router
LAN. In this LAN, the WebMux™ takes the Internet traffic and distributes it to
the servers behind it. The LAN connecting the WebMux™ and real servers
together is called Server LAN.
WebMux has three mode, NAT mode, OOP mode, and transparent mode. In
NAT mode, only the WebMux™ boxes are connected to both Router LAN and
Server LAN. At least one WebMux™ is needed to define the Router LAN and
the Server LAN. We talk other modes in details at later chapters.
The side of the WebMux™ that connects to the Router LAN is to send and
receive all the IP packets from the router to the Internet. The side of the
WebMux™ that connects to the Server LAN is to send and receive IP packets to
and from the servers in the farms. By properly configuring the WebMux™, one
can create one or more Virtual Farms on top of physical hardware.
Hardware Setup --- Collect Information
•
Make a drawing of the existing network and note all the configuration
settings. This will help you to fall back to the existing configurations if
needed.
•
Make a new drawing for the new setup with the WebMux™ and the web
farm in place. This will be used as a guide for setup and preparation of all
the necessary material and equipment.
•
Collect all the IP addresses, their network masks, network addresses, and
broadcast addresses for the Server LAN and Router LAN WebMux™
interfaces. The IP address of the Internet router is also needed.
•
Label all the cables. Prepare additional cables if needed.
•
Make sure there are enough electrical or UPS outlets for all the new
equipment.
Hardware Setup ---Setup the new network
•
Power down all the devices on the network.
•
If you have a secondary WebMux™, connect the WebMuxes with a crossover Ethernet cable.
•
Connect the servers to the Server LAN
•
Connect the WebMux™(es) to the Server LAN
Copyright© 1997-2006 CAI Networks, Inc.
19
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
•
Connect the WebMux™(es) to the Router LAN (NAT and Transparent
mode).
•
Power up all devices in the network.
•
Verify that all the devices are up and running.
•
You are now ready to configure WebMux™.
Hardware Setup ---Configuration Summary
CAUTION: Do not proceed without collecting all necessary information.
NOTE: The IP addresses in the following examples are general examples and are not
meant for literal use in an actual setup.
•
Turn on the WebMux™. Turn on the switch on the back of the WebMux™
and push the power-on button in the front momentarily. You will see the
version number like this:
•
•
•
•
After self-test, hold down the Check-Mark button on the WebMux™ until
the LCD displays the first question – “Enter WebMux host name”.
During the initial configuration, you will be asked to provide names and IP
addresses. (See next section.) Each item is explained in the order it is
asked.
Answer the questions. Reboot. Note: When reboot is complete, the
service statistics screen will appear.
Run the Management Browser.
Initial Configuration
Enter WebMux™ Host Name:
20 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Enter the host name of the WebMux™. Use the right arrow to move the position,
the up and down arrows to select characters, left arrow to move back in position,
check mark button to confirm the change. This host name is for identification
purposes. You may call it webmux1, webmux2, etc. (Trick to enter name
quickly: If you hold down the up/down button for more than a second, the letter
will start changing quickly.) Note the left most down arrow on the LCD allows the
user to skip certain entries.
Enter WebMux™ Domain Name:
This is for identification only; no effect for network operation. Although it can be
any name, we suggest using the primary domain name of the Router LAN
network. If you have only one domain, use that domain name. Note the left most
position on the LCD has changed to an up and down arrow, allowing the user to
go back and forth for questions and answers.
Choose NAT mode or Out-of-Path Mode:
This is where to choose NAT (Network Address Translation) or Out-of-Path mode.
“*” is a default or selected option. Network address translation provides
protection to the servers; it can handle large amounts of data as noted in the
specification. It provides the best security for isolating servers from any other
part of the networks. Out-of-Path provides better performance when huge
amounts of data need to go back to clients (up to 100X more than on the
specification chart); it also does not require a change to the server IP address. If
choosing NAT, continue to the next setting; otherwise, skip next few settings and
go to direct routing. If answer NO here, please continue setup at the Out-of-Path
Related Configuration section.
Transparent Mode:
If selected NAT mode, you can select transparent mode (bridge mode) or not. If
you choose YES, the WebMux™ will be in Transparent Mode and will behave as
Copyright© 1997-2006 CAI Networks, Inc.
21
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
an Ethernet Bridge. Please continue the configuration to the Transparent Mode
Related Configuration section.
NAT Mode Related Configuration
Enter Router LAN WebMux™ Proxy IP Address:
This is the IP address that the WebMux™ uses as the external IP address when
it functions as a proxy. This IP address can be used to setup the first farm.
When any server behind the WebMux™ (on the Server LAN) initiates
communication with another host, the WebMux™ substitutes the servers’ IP
address with this address. (This is true for all services, except FTP services,
which use the FTP farm IP address for passive FTP connection). For redundant
setup, secondary WebMux™ uses the same IP address for this entry as the
primary one. This address floats between primary and secondary WebMuxes.
Enter Router LAN Network IP Address Mask:
This is the network mask of the Router LAN network. It is usually 255.255.255.0
for class C networks.
Enter Server LAN WebMux™ IP Address:
This is the IP address of the WebMux™ interface that connects to the Server
LAN. This IP address must also be unique for each WebMux™. This address
must be different from the server LAN gateway address. The purpose of this IP
address is to allow WebMux™ to check the network and server health situation.
Even for the backup WebMux™, this address must be unique. It is highly
recommended to add this IP address to your servers /etc/hosts file, along with
the gateway IP address, to allow faster name resolution, especially on
Linux/Unix.
In an installation with a primary and secondary WebMux™, one unique IP
address is required for each WebMux™ interface that connects to the Server
22 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
LAN. Those two unique IP addresses are in addition to the gateway IP address
that is floating between the primary and secondary WebMux™.
These IP addresses cannot be your Internet registered addresses. They must be
Internet non-routable. For example, you can assign addresses in a 10.0.0.0
network address range, or a 192.168.199.0, etc.
Enter Server LAN Network IP Address Mask:
This is the network mask of the Server LAN. For a class A network, it may be
255.0.0.0. For a class C network, it may be 255.255.255.0.2
Enter Server LAN Gateway IP address:
This IP address will be the Default Gateway entry for all the servers on the
Server LAN. In an installation with two WebMuxes, if a gateway IP address of
10.1.1.1 is used, this address will ‘float’ between the primary and secondary
WebMux™. If the Primary went down, the 10.1.1.1 address will float to the
backup.
In the single WebMux™ setup, this address CANNOT be the same as the
WebMux™ IP interface address on the Server LAN. For the NAT setup, please
continue to the Common Configuration section.
Trasnparent Mode Related Configuration
Enter Bridge IP Address:
This will be the IP address of the WebMux™ on the network so that you can use
browser to manage it. Although the “server” and “internet” ports are
interchangeable in transparent mode, it is recommended that you stick with
labeling scheme and connect the port labeled “internet” to the switch on the
firewall/router side and connect switch on the servers to the port labeled “server”.
Enter Bridge Net Mask:
Copyright© 1997-2006 CAI Networks, Inc.
23
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
This should match the net mask of the existing network the WebMux™ will be a
part of.
Please continue to the Common Configuration section.
24 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Out-of-Path Related Configuration
Enter Server LAN WebMux™ IP Address:
This is the IP address of the WebMux™ interface that connects to the Server
LAN. This IP address must also be unique for each WebMux™. The purpose of
this IP address is to allow the WebMux™ to check the network and server health.
Even for the backup WebMux™, this address must be unique. It is highly
recommended to add this IP address to your servers /etc/hosts file, along with
the gateway IP address, to allow faster name resolution, especially on
Linux/Unix. Please also refer to Appendix for adding loopback to servers.
In an installation with a primary and secondary WebMux™, one unique IP
address is required for each WebMux™ interface that connects to the Server
LAN. Those two unique IP addresses are in addition to the farm IP address that
is floating between the primary and secondary WebMux™.
Enter Server LAN Network IP Address Mask:
This is the network mask of the Server LAN. For a class A network, it may be
255.0.0.0. For a class C network, it may be 255.255.255.0.
Enter Server LAN Gateway IP address (optional):
This is an optional configuration that is used only if you are going to do SSL
termination or Layer 7 load balancing. Keep in mind this is an IP address
assigned to the Server LAN network interface. Be sure to use a unique IP
address or duplicate IPs on the network will occur. Enter 0.0.0.0 if not needed.
Copyright© 1997-2006 CAI Networks, Inc.
25
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Common Configuration
-For NAT, Transparent (Bridge), and Out-of-Path Mode
Enter External Gateway:
This is the common setup for NAT, Transparent, and Out-of-Path modes. This is
an address on the firewall or router local interface. In NAT mode, the WebMux™
needs to know this to route the server replies back to the clients. Although in Outof-Path mode this is not being used to route return traffic back to the Internet
clients, the WebMux™ does check the connectivity to the incoming side on this
gateway or through this gateway to the ISP side routers. However, for SSL
termination or Layer 7 load balancing, servers need to route traffic back to the
WebMux™ via the server LAN gateway (previously mentioned). The WebMux™
then forwards it to the client through the external gateway. If health check on
extermal gateway is enabled (by default), WebMux will turn the farm listing red to
indicate the external gateway failure.
Is this a Primary WebMux™?
If this is the Primary, answer Yes. If this is the Secondary WebMux™, answer
No. The secondary WebMux™ automatically gets configuration information from
the Primary once it sets up. If this is the only WebMux™, answer Yes.
Primary WebMux™ Information
This question is not asked for the Secondary WebMux™.
Is this WebMux™ running solo without a backup WebMux™?
If the Primary WebMux™ is running in a standalone configuration (see sample
configuration – Standalone WebMux™.), answer Yes. If you plan to add 2nd
WebMux™ in the future, you may answer NO, even there is only one WebMux at
the time.
When you add second WebMux™ later on, WebMux™ will
automatically detect the backup and start functioning.
26 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Clear Allowed Host File?
Allowed host file prevents any unauthorized access to the WebMux™
Management Console. If a workstation’s IP address is not in the allowed host
file, that computer will not be able to reach the WebMux™ management console
through the network. However, sometimes a wrong IP address is entered so that
no computer can access the browser management console. At that point,
clearing the allowed host file will allow any browser to access it. By default, the
allowed host list is empty so that any IP address can access WebMux™. We do
encourage adding only host IP addresses that you do allow to manage
WebMux™ into the list. See configuration through browser interface for more
details.
Remake /home/WebMux/conf/passwd?
This function is provided in case you have forgotten the passwords to access the
Management Console. Please use a browser to access Management Console
for normal password changes. The factory default password is the same as the
login ID on the screen. Answer Y to reset the Passwords to factory default.
Answer N to leave them unchanged.
Enter Admin http Port Number:
This is the http port number for accessing Management Console in non-secure
mode. Any unused port number can be used. Factory default port number is 24,
one could choose to use any unused port below 10214 or port number above
1024 for this. Using port number above 1024 will need to setup an admin farm.
This farm is for preventing port collision in case passive FTP is one of the farms.
Using port number below 1024 will not need to setup this farm.
Enter Admin https Port Number:
This is the https port number for accessing Management Console in secure
mode. Factory default port number is 35, one could choose to use any unused
port below 1024 or port number above 1024 for this. Using port number above
1024 will need to setup an admin farm. That is for preventing port collision in
Copyright© 1997-2006 CAI Networks, Inc.
27
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
case passive FTP is one of your server farms. Using port number below 1024
will not need to have this farm.
Discard Changes Made?
User can select Yes at this point, all the changes made will be discarded. By
default the answer is NO, all the changes will be saved to internal solid state
storage. Changes will take effect after next reboot.
The next question will be Reboot Now?
Reboot now?
This is the end of initial configuration. Most of the setup or changes require a
reboot to take effect. Press and hold the center Check-Mark button to make the
WebMux™ reboot. Use the UP arrow button to return to “Discard Changes” and
select “Yes” to exit without change. Press the DOWN arrow or Cross Button to
continue to the Factory Reset option (see Factory Reset below).
After the WebMux™ is rebooted, the statistics of the incoming package, outgoing
package, etc will be displayed on LCD periodically.
Factory Reset:
Pressing the “down” button or the “x” button at the “Reboot Now?” screen will
bring you to the factory reset option. You will see:
This option will clear all current settings and reset the WebMux™ to original
factory settings. Press and hold the check-mark button for at least 20 seconds to
activate the factory reset. The process will take a few minutes and the
WebMux™ will reboot itself.
28 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
What if I made mistake in my configuration?
One can always make changes to the hardware settings by press the CheckMark button for three seconds when the statistic screen showing. It will start the
prompt questions which will allow the user to navigate from one prompt to
another by using the up/down button on the left most LCD position. For example,
if you configured the Allowed Hosts wrong and lock yourself out, you can go to
the push buttons and select “Clr Allowed Hosts” option, save changes and reboot,
which will allow all the IP address to access the management console through
browser. You can clear the allowed hosts but not reset the password, or change
one option and not change the others.
Copyright© 1997-2006 CAI Networks, Inc.
29
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Management Console
After the Initial Configuration, the user should be able to connect a web browser
to the WebMux™. The web browser does all of the WebMux™ management.
The following sections explain each of the easy to use management console
screens.
•
•
•
•
•
•
•
Login
Administration Setup Page
o Change Password
o Set Clock
Status
Add Farm
Modify Farm
Add Server
Modify Server
30 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Login
Start Login Page:
•
•
•
Start a web browser from your management workstation.
Set URL to https://webmuxip:webmuxport/cgi-bin/login
o webmuxip is the IP address of the WebMux™ on the server LAN.
o webmuxport is the management port address of the WebMux™.
The default ports are 24 for an unsecured connection, and 35 for
the secured connection. Use http instead of https on the URL line if
you decide to use port 24 for unsecured communications. (The port
number can be changed per your specification, under “setup” in
“main management console” section).
The following login page will appear.
NOTE: In order to use a browser to manage the WebMux™, the browser must be set to accept
all cookies.
User ID:
There are two preset user IDs
Super User - Allows access to all screens and functions provided by the
WebMux™.
WebMux™ - Does not allow the user to access or change any settings; allows
viewing only.
Password:
Fill in the correct password for the selected User ID. The password is case
sensitive.
Copyright© 1997-2006 CAI Networks, Inc.
31
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
The default passwords are:
ID
Password
superuser superuser
webmux
webmux
It is recommended to change the passwords periodically. No new user ID can be
added.
Login:
After entering the correct password, click Login.
NOTE: For first time setup, please login as superuser and go to the Administration Setup by
clicking the Setup button. It is important to set up the Server Farm Gateway IP address and
network mask first.
32 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Main Management Console
Once logged in to the Management Console, this main screen will show. To
continue configuring the WebMux™ , the normal steps are:
Click on the “Setup” button to change administration and setup related
information;
Click on “SSL keys” button to manage SSL keys, if SSL termination is desired;
Click on “Add Farm” button to add a server farm at a time;
Click on the “IP address” portion of the farm display to add servers;
Click on “Save” button to save the farm/server configuration.
Click on “services” on each farm to adjust the timeout for each kind of services.
Note that same protocol services between farms will share the same timeout
value.
We will discuss those buttons and related features in great details in later
sections. Other buttons on the main management console screen are:
Save
On main management console, click Save button will cause WebMux save its
configuration. Changes made to the "Farm" and "Server" will take effect
immediately without save. The changes however are not saved permanently to
the solid state storage until the "Save" button is clicked. Unsaved farm/server
settings will be lost during power outage or WebMux™ reboot.
Copyright© 1997-2006 CAI Networks, Inc.
33
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Download/Upload
This button will allow the user to save and restore the WebMux™ configuration to
and from their management workstation. See later chapter for details.
Setup
This button brings up the “Administration Setup” page. "superuser" login is
required to access this page. See related section later for details.
Show Event
This button will display all the events since the WebMux’s last reboot. The event
includes server failure or state change.
Logout
It is not recommended to leave the management browser login unattended. Click
the Logout button to close the session. The “Login” screen will re-appear.
Pause/ Resume
The status screen automatically refreshes frequently to provide most up to date
status. You can use the Pause button to freeze the auto refresh.
After the Pause button is pushed, the button will change to Resume and the auto
refresh stopped. Click the Resume button to restart the auto refresh.
Adjusting Timeout for Each Service
Clicking on the service type on each farm will allow you to change the timeout
value of layer 7 testing for each different service. Please note this change is
global and will affect all the farms using the same type of service. For example,
the default timeout for checking HTTP protocol alive or not is 5 seconds. If the
web server does not respond to the WebMux™ protocol chat within 5 seconds,
the WebMux™ will declare that server is dead and switch that server out from
service and notify the operator through email or pager. However, if your web
server is not really dead but for some reason not responding to the checking
request, the WebMux™ will false alarm. To avoid this, the user can change the
timeout value to a larger value. Many times, servers can not resolve the IP
address for the back end of the WebMux™ IP address and could cause the
server to not respond to the WebMux’s protocol checking. Adding the WebMux™
server LAN IP address and server LAN gateway address to the name resolution
table will help resolve this problem. Please read the Q&A section for more
information.
34 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Administration Set Up
After login into management console as superuser, click on the setup button, you
will come to this screen:
Allowed remote host IPs:
The WebMux™ management console and diagnostic login only allow logins from
these IP addresses to establish a management session. You can access from
more than one IP address by specifying all the allowed IP addresses separated
by a ":". Netmask following the IP address specify the range of hosts can access
management console. For example, 192.168.12.0/24 will allow all hosts in
192.168.12 network to access it. From version 6.4.00, 192.168.12 will be
allowed for class C allowed host. If this field is left blank, you can access the
Copyright© 1997-2006 CAI Networks, Inc.
35
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
management software from any IP address. It is recommended to set this up for
security reasons. If wrong IP addresses are entered, management console login
might not be possible. Use the push button controls on the WebMux™ to clear
the allowed host list. This field is blank by default.
Dialout prefix:
Some phone systems require a prefix for outside phone numbers. If a prefix is
required, enter it here. Leave it blank if a prefix is not required. For most Analog
PBX, this will be “9”. Do not enter anything in here, if modem is not connected.
Pager phone numbers:
This is the pager phone number to be dialed when an abnormal condition occurs.
Enter the number without any special characters or spaces. It should be in the
format of a single long integer. Add 1 and the area code if needed. Do not use
"()" or "-" or blank spaces. Do not enter anything in here, if modem is not
connected.
Server for email notification:
In addition to paging, the WebMux™ can send email notifications. Enter the IP
address of the email server that will forward the notifications. Please note:
Because the WebMux™ does not resolve names, this entry must be an IP
address. Changes to the email server allowing the WebMux™ to relay messages
are necessary.
Addresses for email notification:
Enter the email addresses to be notified. Separate multiple addresses with a
colon. For example: [email protected]:[email protected]
UDP syslog server IP address notification:
The WebMux™ can be configured to send syslog messages to a remote syslogd
server. Enter the syslogd server IP address to use this feature. The syslogd
server must be configured to accept remote UDP syslog connections. The
facility for WebMux™ syslog messages is LOCAL6.
The notification levels of the syslog messages are as follows:
Level
Search Key
Description
INFO
STATS
LCD display messages
NOTICE
LOGIN
Successful
browser
login/logout (exludes timeout
logout)
NOTICE
SETUP
Significant
access
and
changes to setup and
configuration items.
NOTICE
EVENT
Same
as
pager/mail
messages
WARNING
LOGIN
Unsuccessful browser login
36 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Server gateway IP address:
The WebMux™ appears to all the servers in the farms as a gateway or router.
This is the IP address for the WebMux™ acting as a router for the servers. This
address should be the gateway IP address in the web (or other) servers. It is
highly recommend adding it to the /etc/hosts file on your servers. Only apply for
the NAT mode (or for Out-of-Path mode that requires the WebMux™ to do the
SSL termation or Layer 7 load balancing. Normally, it this is optional for Out-ofPath mode).
PLEASE NOTE: For first time setup, it is very important to set up this address
and the Server Farm network mask (below) first. Also when setting up the
servers, you may be asked to fill in the default gateway IP address for the server.
Use this IP address to setup all the servers under it. The WebMux™ will not
function properly if this IP address is not set correctly for both WebMux™ and the
servers.
WebMux™ http control port:
Since the WebMux™ is load balancing incoming HTTP traffic, the HTTP port for
the management console must be set to a different port. By default, the port is
24. You can change the port to any port that is not being load balanced, if so
desired. The font push buttons can also change this.
WebMux™ https control port:
Since the WebMux™ is load balancing incoming HTTPS traffic, the HTTPS port
for the management console must be set to a different port. By default, the port
is 35. You can change the port to any port that is not being load balanced, if so
desired. The front push buttons can also change this.
WebMux™ diagnostic ports:
The WebMux™ allows diagnostic sessions from remote access for factory
technical support or trained network engineers through ssh or telnet. Access is
also subject to the restriction of the “Allowed-Host” setting earlier. “superuser”
can login with its password using “ssh” to run certain diagnostic tools (help shows
the commands, how to use these commands are not supported). When this entry
is blank, any diagnostic access is denied. This entry should remain blank under
normal operations. Default port numbers are 77 / 87. The first port is ssh and
second is telnet. If only one port specified, only ssh login is possible. You will
need to notify us the port numbers before obtaining support from us.
Connection warning threshold:
The WebMux™ monitors the number of connections established. When the
number of connections is greater than the value entered, the WebMux™ will
page the designated numbers. For example, if a DoS attack is occurring, the
number of connections to the site would be extremely high. Assuming they
exceeded the value set for the “connection warning” threshold, the designated
numbers would be paged.
Copyright© 1997-2006 CAI Networks, Inc.
37
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Least significant bits in client IP address to ignore for persistent connections:
This feature allows persistent connections to be handled properly when
communicating with America Online’s bank of cache servers. With AOL’s cache
servers, the IP address of the cache server becomes the source address. Since
an end user can be sent through multiple cache servers; it is possible the
requests for one HTML page are being routed to different web servers in the
same session. Therefore, applications, such as shopping carts, that require
persistent and secure connections will not work properly. This feature will treat
multiple cache servers as one source, thus the WebMux™ can properly handle
the persistent requests from browsers. From customers’ feedback, number three
(3) is good enough for most AOL requests.
The WebMux™ will use this entry to determine how to load-balance the traffic. It
calculates based on two to the power of the entry as the number of IP addresses
to combine. When too large a mask applied, it will defeat the load balancing
function of the WebMux™.
ICMP Packet input policy:
Accept: The WebMux™ will allow all ICMP packets to travel through the
WebMux™. For CLI arp commands working properly, this must be accept.
Deny: The WebMux™ will NOT allow any ICMP packets to travel through the
WebMux™.
NOTE: During installation, having the ability to PING the other hosts on the
networks is typically useful. When the installation is complete, setting the “ICMP
packet policy” to DENY, is recommended as a security precaution.
Forward Policy:
Accept: The WebMux™ will route IP packets both directions. The WebMux™ will
not act as a firewall in this mode.
Deny: The WebMux™ will NOT allow any incoming IP packet traveling through
the WebMux™, except IP packets in farm IP/port. This is the default setting.
Front Router Connection Verification:
It can be “none”, “ARP”, “TCP Connection”, or “ping”. Depending on the front
end router, this can be changed. For example, most Cisco routers will talk to the
WebMux™ through ARP and TCP Connection; however, most Cisco DSL
modems will only talk to the WebMux™ through Ping. The change to this
verification method will take effect after the WebMux™ has been rebooted.
Front Router Connection Verification IP Address:
It can be the router in front of the WebMux™, or a router in your ISP’s WAN. It is
recommended to have the router IP address as the verification IP address.
However, it can be any address that is reachable on your Internet side. When
farm listing turning red, it is an indication that this address failed check.
38 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Persistence Timeout:
The WebMux™ will keep track the browser connections if the persistent farm is
defined and accessed. Within the timeout time period, the WebMux™ will send
any request from the browser IP address to the same server. Our survey shows
5-6 minutes is the best value for most cases. The larger the persistence timeout
value, the less chance user connection get lost. However, by keeping a lot of
connections in the WebMux™ memory, the maximum number of concurrent
connections will drop.
Outbound Connection Timeout:
The WebMux™ keeps track the outbound connections. This outbound proxy
function provides communication tunnels for servers behind it to talk to other
computers on the Internet side. This type of connection is different from the
connections from outside through server farms to the servers. After the
connection closed from the servers to the outside computer, it will wait this
timeout minutes before it removes that from the tracking table. Setting this too
long will cause the WebMux™ to allocate too much memory, thus reduce the
memory for other functions. The default value is 15 minutes. This function has
no effect in Out-of-Path mode.
Server Scan Mode:
The WebMux™ talks to the real servers in the farm through the layer 4-7
protocols every few seconds. This is important process for monitoring servers’
health situation. If there are a lot of farms and a lot of servers, the WebMux™
may not be able to get around checking all the servers in few seconds. In
concurrent mode, the WebMux™ will start multiple protocol scanners to chat with
servers concurrently. Concurrent mode uses more memory and may have other
side effects. For most setups, sequential scan is recommended.
URL for Custom Service Check:
Sometimes the WebMux™ built-in server health check is not enough for special
needs. When one ASP/JSP server’s output depends on the database server and
the database server connection is down, one might want to reduce the incoming
traffic to the server, suspend new traffic to the server, or totally redirect incoming
traffic to a different server. To accomplish that, the WebMux™ allows a farm
being set using a “custom defined service”. It will then call the CGI’s URL on the
server defined in this field. This will involve a custom developed CGI code by
your software developer on your server and place it on the path. Upon success
the page should return HTTP response code 200 and a plain text page beginning
with one of the allowed responses. The URL is truncated to 255 bytes (to be a
string of at most 256 bytes with a terminating null). The response from the server
must fit in 4k, including all non-display tag and headers etc. This custom CGI
code must complete within 15 seconds or the server is considered dead. The
custom defined service also allows for CGI code responses that allow the server
to change its own weight and announce such change to a remote syslog daemon.
Please see appendix 5 for a sample code and a list of allowed responses.
Copyright© 1997-2006 CAI Networks, Inc.
39
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
UDP NTP Time Server IP Address:
Since version 5.4, the WebMux™ can sync its internal clock with any UDP NTP
server. By default it points to a tier 2 NTP server. You can also set it to your
Internet NTP server, or wipe out the entry to not sync to any NTP server.
Reset Stranded TCP Connections:
When a server failed to function, there could be many TCP connections still in
TCP_WAIT state. If this set to “Yes”, when client tries to access the failed server,
the WebMux™ will pretend the server is sending TCP Reset to the client, thus
freeing all the TCP_WAIT state connections. Default setting is “Yes” to conserve
resources.
Reboot:
Changes to “TACACS+ server configuration”, "server gateway address", "server
farm network mask", "WebMux™ http control port", “WebMux™ https control
port” “WebMux diagnostic ports”, “least significant bits”, “forwarding policy”, “front
network verification”, and “persistence timeout” requires a reboot for the new
configuration to take effect. You can use the Reboot button to reboot the
WebMux™ remotely.
Reboot button does require confirmation before
proceeding with reboot.
40 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Change Password
Name:
Select the login name for which the password is to be changed.
New Password:
Enter the new password. This is the password to which the login will be
changed.
New Password Again:
Enter the same password as in the previous box.
Confirm/Cancel:
Click Confirm to execute the change. Click Cancel to return to the
previous screen WITHOUT changing the password.
Copyright© 1997-2006 CAI Networks, Inc.
41
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Change PIN
To protect the WebMux™ from unauthorized changes from front push buttons, a
PIN can be entered here to prevent saving any change from the front panel. By
default, there is no PIN.
42 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Set Clock
Click this button to go to the “Set the Clock” page. The time and date of the
WebMux™ then can be set. Please note that the WebMux™ internally uses GMT
time zone, not your local time zone, per W3C/HTTP protocol. If the timezone is
not set correctly, the browser access could be denied due to “cookie” time out. If
the UDP NTP server is set up correctly, there is no need to set the clock
anymore, since the WebMux™ automatically sets its clock periodically.
Month:
Enter the number of the month, 1 through 12. Leading zeroes are not necessary.
Day of the Month:
Enter the day of the month, 1 through 31.
Year:
Enter the year. Enter all 4 digits.
Hour:
Enter the hour of the day. Use the 24 hour clock, or military time.
Minute:
Enter the minute of the hour.
Copyright© 1997-2006 CAI Networks, Inc.
43
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
NOTE: It is recommended to set the WebMux™ clock to UTC (GMT) time.
Time Zone:
Select the time or hour offset to the UTC (GMT) time. You can set the WebMux
™ to your local time, if your time zone is selected here.
Confirm/Cancel:
Click Confirm to execute the date and time change. Click Cancel to return to the
previous screen WITHOUT making any date or time changes.
44 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Add Farm
Click Add Farm to add a virtual site for the services you want to provide. The
“ADD FARM” screen will appear:
By default, the SSL termination is NOT on. The description here is for for the
481S model. Other models can be configured similarly.
During “Add Farm” action, first select “add HTTP farm”, then click on the “Select
SSL Termination”. Choosing from any key other than “none” will enable SSL
termination on the HTTP farm. All the HTTPS incoming traffic will be sent
terminated to farms on HTTP port (80). Please set the port to a clear port, since
Copyright© 1997-2006 CAI Networks, Inc.
45
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
after the WebMux™ terminates the SSL traffic, only clear traffic will go to servers.
When the servers return traffic back, the WebMux™ will re-encrypt the data and
send encrypted back to client. If you are using out-of-path mode, please make
sure your servers’ gateway points to the WebMux™ server LAN gateway IP
address; so that the WebMux™ has the chance to re-encrypt the data before
replying back to clients.
One can also block not encrypted incoming traffic, so that only encrypted traffic
can reach to your server. This might be useful, when you only want encrypted
traffic reaching to your servers.
If you like to track on your server if the incoming traffic was HTTPS or HTTP, you
may turn on “tag SSL terminated HTTP traffic”. By change that to "Yes",
decrypted traffic will have the added MIME header "X-WebMux-SSL-termination:
true”. You can write script on your server to identify if the original traffic was
HTTPS or HTTP, and then properly redirect the traffic to the HTTPS.
46 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
SSL Keys
WebMux™ model 481S, 591SG, 680PG support SSL termination. For models
that do not support SSL termination, please ignore this section. WebMux™
supports SSL V2, SSL V3, and TLS V1 with RSA key length from 512, 1024, and
2048. For each WebMux™, one can have 16 SSL certificates: Any key can be
active or not active. The first line of the private key is the comment. See included
Copyright© 1997-2006 CAI Networks, Inc.
47
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
two sample keys for details. If there is no comment line in the key, it will be blank.
If there is no key, it will display “(key and certificate unset)”.
Key length can be different from 512 to 2048. RSA key length 1024 also called
128bit strong encryption. You can click “manage key1” or “manage key2” to
generate keys, copy and paste signed certificates:
You can view, copy and paste keys into the two windows. You should backup
your private key and save in a secure place. Each private key and public key
pair must match to be able to work properly.
48 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
If you plan to generate new keys, click on the drop down box above the private
key window to select key length, and then click on the “Confirm” button. This
process is also known as “generate a CSR” – Certificate Signing Request. It is
the process that you generated a key pair and send the public key to CA for
“signing”. Once your public key signed and pasted into the key management
screen, all the browsers over Internet will accept it without complaint during its
life signed in the key. You can visit www.thawte.com or www.verisign.com for
more information.
Enter all the information necessary. Click on “Confirm” button to complete the key
generation. You will be taken back to the dialog boxes that will display the newly
created private and public keys.
You will then copy and save both private and public keys, submit the public key
to the CA of your choice to sign. Once they send you back the signed public key,
you will need to paste that into this certificate dialog box, select “using new key
pasted in” and click on confirm button to save it into the WebMux™.
Copyright© 1997-2006 CAI Networks, Inc.
49
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
There should be 3 certificates. The one whose identity is your e-mail address is
the site certificate. The one whose subject and issue are identical is the CA root.
The 3rd one is called intermediate certificate. Please paste your site certificate
first, followed by your intermediate certificate.
If you have existing signed keys from a Windows IIS server or a Linux server,
you can transfer them into the WebMux™ and continue using them until they
expire. Please contact us for how to convert your existing keys.
50 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Upload/Download
Download:
This feature allows the SAVED (not necessarily the active) configuration to
be saved at the Administrative Browser workstation. Click on the Click
Here to display the configuration. Choose ‘File->Save As’ from the
browser menu to save it as a text file. Changes can be made to this file
and uploaded to the WebMux™ without changing the first comment line.
Upload:
Upload allows a configuration file that has been saved at the browser
workstation to be uploaded to the WebMux™. Enter the full path of the
configuration file, or click on Browse to search for the file. Click Upload to
upload the file to the WebMux™. This file will IMMEDIATELY become the
saved and active configuration. Upload ALL Settings to WebMux™ will
actually upload settings including IP address and farm setups. If you want
to replace the WebMux™ with a new unit, you could save the configuration
and upload all settings to the WebMux™ , so that you do not need to go
Copyright© 1997-2006 CAI Networks, Inc.
51
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
through step by step configuration (requires both WebMuxes on the same
firmware revision).
52 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
More about Add Farm
Farm IP address:
This is the IP address of the new farm.
For SSL terminated traffic, each farm must have its own IP address.
The farm address could be the Internet known address or the address has been
translated by your firewall. For example, if you want to create an http farm for
www.mydomain.com, the farm IP address will be the IP address for
www.mydomain.com from your DNS record.
If the IP address of
www.mydomain.com is 205.188.166.10, then the Farm IP address is also
Copyright© 1997-2006 CAI Networks, Inc.
53
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
205.188.166.10. The WebMux™ will then translate the farm address to the web
server address in your DMZ or internal network.
Since version 4.0.3, we also introduced “label” concept for the farms and servers.
Once the label is specified, the WebMux™ will display in the Show-Status screen
the label for the farm and server instead of the IP addresses. Although labels
can be anything, it is better to have meaningful and unique label for each farm or
server. Since version 5.6, the name label is also being used to check HTTP
layer 7 protocols as part of the MIME header in virtual hosting. The format of the
farm name label will be www.xyz.com, max length 75 bytes. If the server returns
error code 401, the WebMux™ considers that server dead. For both IIS and
Apache servers doing virtual hosting, the farm name label must be an existing
web site name on the server. For more information on Virtual hosting, please go
to Appendix 4 for details.
In NAT mode, if you use the WebMux™ for your intranet, then the farm IP
address will be the IP address of the original web or application server. The web
or application servers must be changed their IP addresses so that the WebMux™
can translate farm IP address to the server IP address. You can use the
WebMux™ Router LAN IP address as your farm address to save IP address.
You can add multiple farms to this IP address, as long as the port number is
different.
In the NAT (not TM) mode, the WebMux™ acts as a firewall also, all ports except
farm port(s) are blocked. All servers behind the WebMux™ can reach to the
outside through the WebMux™ . From outside, the traffic can be seen all come
from the WebMux™ router LAN IP address, or proxy address. If a WebMux™ is
placed behind a firewall, please add a rule on firewall for WebMux router LAN
address to anywhere/anyport. All farm IP addresses should have rules to allow
incoming traffic mapped to the address and port number, as well as return traffic
for each farm IP address from any port to anywhere.
In Transparent (TM or bridge) mode, there is no firewall protection from WebMux.
All servers talk to each other freely cross WebMux. Only the farm IP/port
address is being load balanced using any selected scheduling method.
In Out-of-Path mode, farm(s) must be a different IP address than the WebMux™
Server LAN IP address. At this mode, only server LAN cable is connected.
Multiple farms can be added to one IP address, as long as the port number is
different from each other. In this mode, each server must add a loopback
adapter and under Windows server, the route for the loopback adapter must be
removed. Please refer to Appendix 1 and 2 for more detailed procedures.
WebMux™ has been tested extensively working with all versions of Windows,
Linux and HP-UX 11.X under this mode. Other OS should also working fine.
54 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
CAUTION: Once a new farm is added, the IP address of the farm cannot be changed. To
correct the IP address, the old farm has to be deleted and a new one to be created.
Port:
This is the port number for the farm. If you are choosing one of the known
services below, you do not have to specify anything in this field. However, if the
service you choose is not listed in the list below, you will need to specify a port
number here. For example, for MS Terminal Services, use port number 3389. If
you enabled SSL termination (see last chapter), select port 80 for the farm and
servers in the farm. The WebMux™ will terminate all SSL (on port 443) traffic
and send them to port 80(DO NOT select port 443 if you enabled SSL
termination). For example, if you have five port-80 farms and your WebMux™
only allows one certificate, the WebMux™ will use same certificate for all five
farms.
Service:
This is the service of the new farm. Select a service type to create a farm using
its well-known port. If a port other than a well-known port for TCP or UDP
service is to be used, then choose one of the “Generic” selections, and enter the
port number in the PORT NUMBER box. No port number needed to be specified,
if the service protocol is on the list. The WebMux™ has level 7 protocol checks
for the known ports in the list. For Custom Defined TCP Service (custom health
check), please specify the URL for the CGI code in the setup screen.
CAUTION: Once a farm is created, the port number cannot be changed. Like the IP address,
the old farm must be deleted and a new one created, in order to change farm settings. Please
choose “Generic TCP” and specify port number, if service is not listed below. If multiple ports to
be used, please also select “Generic TCP” and specify port number “0”.
Service
DNS – Domain Name Service (TCP)
FTP – File Transfer Protocol (TCP)
HTTP – Hypertext Transfer Protocol (TCP)
HTTPS – Secure Hypertext Transfer
Protocol (TCP)
HTTP/HTTPS Combined Ports
NTP – Network Time Protocol
POP3 – Post Office Protocol
SMTP – Simple Mail Transfer Protocol
(TCP)
Generic TCP
Generic UDP
Generic TCP/UDP
Generic no health check (TCP)
Generic no health check (UDP)
Generic no health check (TCP/UDP)
Copyright© 1997-2006 CAI Networks, Inc.
Well-Known Port#
53
21
80
443
80/443
123
110
25
User Specify
User Specify
User Specify
User Specify
User Specify
User Specify
55
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Custom Defined TCP Services
Custom Defined UDP Services
Custom Defined TCP/UDP Services
Custom Defined Paired HTTP and HTTPS
(TCP) Service
80 or User Specify
User Specify
User Specify
User Specify
Scheduling method:
The scheduling method is the way in which traffic is distributed among the
servers in the farm. Eight different methods are supported. If you are using a
shopping cart service, a persistent scheduling method is recommended.
• Least connections
• Least connections - persistent
• Round robin
• Round robin - persistent
• Weighted least connections
• Weighted least connections - persistent
• Weighted round robin
• Weighted round robin – persistent
• Weighted fastest response
• Weighted fastest response - persistent
• Layer 7 HTTP URI load directing
• Layer 7 HTTP URI load directing with cookies
• Layer 7 hashed URI load directing
Layer 7 scheduling methods can only be used with the HTTP – Hypertext
Transfer Protocol (TCP) service. These scheduling methods allow you to direct
traffic to a specific group of servers depending on a match pattern that is
compared to the URI in the client’s GET request header.
Layer 7 HTTP URI load directing with cookies allows the WebMux™ to direct
traffic from the same client to the same server in the farm. This scheduling
method also compares the match pattern against the host MIME header. In
other words, a host name can be specified as a match pattern. Also, if the server
generates a cookie, the WebMux™ will generate its own cookie to keep track of
which client session belongs to which server. These are useful for shopping cart
services, for example, so that a client will be directed to the same server and
keep their shopping cart items valid. The WebMux™ ’s cookie expire time
matches the MAX_AGE setting specified in the cookie generated by the servers.
When MAX_AGE is not defined, the cookie expire time is 30 minutes.
56 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Layer 7 hashed URI load directing does a mod function on the URI string as part
of its load balancing mechanism.
SSL Termination:
Selecting an SSL key in this section will enable SSL termination for this farm.
The HTTP service and POP3 service terminate to ports 443 and 995, repectively,
and will allow you to choose any port for the clear traffic to the servers.
When using the generic or custom services, specifying the clear traffic port for
the service in the “port number” section causes the WebMux to automatically
assume the secure port for the following services:
Clear Traffic Port Secure Port
Service
80
443
HTTP
110
995
POP3
23
992
Telnet
25
465
SMTP
119
563
NNTP
143
993
IMAP
194
994
IRC
389
636
LDAP
Copyright© 1997-2006 CAI Networks, Inc.
57
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Modify Farm
Modify farm can be invoked from the main management console screen by
clicking on the farm IP addresses or labels.
Farm IP address and port number:
These numbers are displayed here for reference purposes. These fields are set
in the "Add Farm" screen. Once set, they are not changeable. If they must be
changed, delete the farm and then add a new one.
Label:
The label field can be changed to make it fit better for describing the farm.
Change this will not affect how load balancing works.
Farm scheduling method:
Eight different methods are supported:
• Least connections
• Least connections - persistent
• Round robin
• Round robin - persistent
• Weighted least connections
• Weighted least connections - persistent
• Weighted round robin
• Weighted round robin – persistent
• Weighted fastest response
58 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
•
•
•
Weighted fastest response – persistent
Layer 7 HTTP URI load directing
Layer 7 HTTP URI load directing with cookies (this method also checks
the host MIME header against the specified match pattern)
Key Selection:
You can change the SSL certification/key pair used for this farm. All current
connection for this farm will be reset if the key changes.
Block Clear Port:
If you do not want to allow non-encrypted traffic going to server, change the “No”
to “Yes”.
Tag SSL-terminated HTTP requests:
If SSL termination is active for this farm, choosing “Yes” for this option will add a
“X-WebMux-SSL-termination: true” MIME header in the decrypted http request.
Delete:
Click this button to delete the entire farm.
CAUTION: This function also deletes ALL the servers under this farm.
Copyright© 1997-2006 CAI Networks, Inc.
59
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Add Server
Click this button to add a new server to this farm.
Server IP Address:
This is the IP address of the server to be added.
Since version 4.0.3, the WebMux™ allows adding a label next to each server’s IP
address. The purpose of labeling a server is only to help identify the server in
the farm. It has nothing to do with the name resolution of the server. Although
label can be anything, it is always better to have meaningful and unique label for
each server.
CAUTION: Once the server is added, the IP address cannot be changed. To correct the IP
address, the server must be deleted and a new one be created.
Server Port Number:
Enter the port number of the server to be added.
CAUTION: Like the IP address, once created, the port number cannot be changed. To correct
the port number, the old server needs to be deleted and a new one to be created.
60 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Weight:
Scheduling priority weight. Valid integer numbers are between 1 and 100. A
server that has a weight of 2 will be directed twice as much traffic as a server
with a weight of 1.
A special zero weight setting is provided for a graceful shut down of a server.
When the weight is changed to zero, the WebMux™ will not send new
connections, but will maintain all current connections to the server. The
connections will gradually reduce to zero as current clients’ sessions terminated.
When there are no connections, the server is functionally “dead” or off line until
the weight is changed back to a valid number. Then the server can then be
shutdown or taken out of service without affecting any users.
CAUTION: Unlike a server that can go down unexpectedly, the WebMux™ will not move a
STANDBY server to ACTIVE when one or more server's weight is set to zero. If the weight of all
the servers in a farm were set to zero, then the farm would be “down” because none of the
servers are accepting new connections.
Run State
•
•
•
•
Active - The server will be put into service immediately after it is added.
However, once it is failed, it will stay Standby mode until manually setting
its run state to Active again through the browser interface. This will give
system administrator time to fix the system or reboot the server once
some software/hardware update is completed.
Favorite Active – The server will be put into services immediately after it
is added. If a Favorite Active server failed, once it is operational, the
WebMux™ will automatically put it back to the Active state.
Standby - The server will be put into STANDBY, or backup, mode after it
is added. The WebMux™ will change a STANDBY server to ACTIVE
when one or more ACTIVE servers fail.
Last Resort Standby – The server will be put into STANDBY state,
unless all other servers are out of services, this server will not be switch
in. This will allow the last server to show a different web page from others.
Copyright© 1997-2006 CAI Networks, Inc.
61
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Add Address/Port
Click this button to create additional IP address/port/protocol combinations for the
farm.
Farm IP and Port:
These numbers are displayed here for reference purposes. These fields are set
in the "Add Farm" screen. Once set, they are not changeable. If they must be
changed, delete the farm and then add a new one.
IP Address:
Add an IP address to the current farm configuration. The IP address can be the
same as long as the port number does not duplicate any existing IP/port
combinations.
Label:
The label field can be changed to make it fit better for describing the farm.
Change this will not affect how load balancing works.
Port Number:
You can specify a port number that doesn’t duplicate any existing IP/port
combinations. A port number of “all” will enable all port ranges, but excluding
any already existing ports associated with the specified IP address. Please see
62 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
the note at the end of this section regarding the behaviors of the additional
IP/port in conjunction with SSL termination.
Protocol:
You can choose TCP, UDP, or combined TCP/UDP.
NOTE: If your farm is already SSL terminated and you create an additional IP/port combination
using the main farm IP and specifying the same secure port (or “all”), the SSL termination by the
WebMux will be bypassed and SSL will be done directly by the server.
Also, the health check mechanism for the servers is dictated by the main farm service. For
example, if the farm is using the http service and you create an additional IP/port for telnet access,
the WebMux will continue to monitor the status of the servers via the http service health check.
The telnet service is not monitored. If you require that such additional services be monitored, we
recommend that you initially create a farm using custom health checking and create a specific CGI
scripting that will monitor your specific services.
Copyright© 1997-2006 CAI Networks, Inc.
63
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Add L7 Server
If setting up a Layer 7 farm, the add server screen will be similar to this:
Two options extra options are available:
• Match Pattern
• Pattern is anchored
Match Pattern:
This is the pattern the URI will be compared to. It is stated in extended regular
expressions format. Please refer to Appendix 7 for some examples.
Pattern is Anchored:
Will include checking the portion of the URL right after the “http://”.
NOTE: If you chose Layer 7 URI load directing with cookies as the scheduling method, the match
pattern is also compared to the host MIME header. In other words, you can use a host name as a
match pattern criterion.
64 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Modify Server
Modify Server can be invoked by clicking on the server IP address on the Status
screen.
Destination server IP address and port number:
These parameters are set in the “Add Server” screen. Once set, these fields
cannot be modified. To correct this setting, delete the server and add a new one.
Label:
The label can be changed at any time. The change will not affect how server is
performing in the farm; rather it is for description purpose only.
Weight:
Scheduling priority weight. Valid integer numbers are between 0 and 100.
Changing the weight to zero will stop the incoming connections while all existing
connections continue until time out or connection is terminated by client and
server. Although all numbers from 1 to 100 will allow traffic to go through, using a
smaller weight number in each server will have the best load distributing result.
Copyright© 1997-2006 CAI Networks, Inc.
65
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Running state:
•
•
•
•
Active
Favorite Active
Standby
Last Resort Standby
66 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Initial setup change Through Browser
Sometimes users like to change the basic settings for the WebMux™ through
browser interface, for example, when the WebMux™ located in a hosting center
across the country. If one has information about the WebMux™ current basic
settings, one could change those parameters through browser. On the browser,
enter the following URL:
https://webmux_ip:webmux_manage_port/cgi-bin/rec
For
example,
if
your
webmux_ip
is
webmux_manage_port is 24, your URL will be
http://192.168.12.1:24/cgi-bin/rec
192.168.12.1,
and
your
The first screen in “rec” (reconfiguration) asks for the superuser’s password. The
default superuser’s password is “superuser”, however, the actual superuser’s
password may had been changed by the system administrator. If you could not
remember the superuser’s password, someone has to go to the keypad to reset
the password. See page 22 for more details.
The next question on the screen asks to set the time in the WebMux™. The
WebMux™ uses its clock to set the cookie for the management browser. When
a WebMux™ manager is logged in for more than 8 hours without activity, the
WebMux™ will log out the user based on the cookie. However, if the clock is off
by more than 8 hours, the manager will not be able to login in to the WebMux™.
Copyright© 1997-2006 CAI Networks, Inc.
67
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
This section on the “rec” screen will allow the manager to correct the clock, if it is
off. After entering proper password and setting the clock information (optional),
the “continue” button will bring up this screen:
When the mouse moved over a field, the current value will be automatically filled.
The user may change it based on new information obtained from ISP or network
engineers. Once you press on the submit button, the WebMux™ will save all the
changes to its internal solid state storage and reboot itself with the new value.
68 Copyright© 1997-2006 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Initial Configuration Worksheets
Configuration Before WebMux™ Installation
Equipment
IP Address
Internet Router (or Firewall) Address
Webserver(s) Default Gateway
Web Site IP Addresses
Configuration After WebMux™ Installation
Question
Primary
Entry
Secondary
Host Name
Domain Name
NAT, Transparent, or Out-of-Path
Router LAN Information (NAT ONLY)
Router LAN WebMux™ Proxy IP Address
Router LAN Network IP Address Mask
Server LAN Information (NAT and OOP)
Server LAN WebMux™ IP Address
Server LAN Gateway IP Address (optional for OOP)
Server LAN Network IP Address Mask
Bridge Settings (For Transparent Mode Only)
WebMux Bridge IP Address
WebMux Bridge IP Network Mask
Administration Setup Information
External Gateway Address
Remake /home/WebMux/conf/passwd
Administration HTTP Port Number
Secure Administration HTTP Port #
Is this WebMux™ primary
WebMux™ running solo without backup
Y/N
Y/N
Y
Y/N
N
Reboot?
Y/N
Y/N
Copyright© 1997-2005 CAI Networks, Inc.
69
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Sample Configuration Worksheets
Standalone WebMux™ NAT Mode
Configuration Before WebMux™ Installation
Equipment
IP Address
Internet Router (or Firewall) Address
205.133.156.1
Webserver(s) Default Gateway
205.133.156.1
Web Site IP Address
205.133.156.200
Configuration After WebMux™ Installation
Question
Entry
webmux
Host Name
Domain Name
NAT, Transparent, or Out-of-Path
cainetworks.com
NAT
Router LAN Information
Router LAN WebMux™ Proxy IP Address
Router LAN Network IP Address Mask
205.133.156.200
255.255.255.0
Server LAN Information
Server LAN WebMux™ IP Address
Server LAN Gateway IP Address
Server LAN Network IP Address Mask
192.168.199.251
192.168.199.1
255.255.255.0
Administration Setup Information
External Gateway IP address
Remake /home/WebMux/conf/passwd
Administration HTTP Port Number
Secure Administration HTTPS Port Number
Is this WebMux™ primary
WebMux™ running solo without backup
205.133.156.1
Y
24
35
Y
Y
Reboot?
Y
You will also need to change the Web server IP address to 192.168.199.10, and
its default gateway to 192.168.199.1. Add a farm for 205.133.156.200 and add a
server to the farm at 192.168.199.10. You can then add more servers at
192.168.199.20 and 192.168.199.30. You can also add additional farm at
205.133.156.210, and add above three servers to the 2nd farm.
70 Copyright© 1997-2005 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Standalone WebMux™ Transparent Mode
Configuration Before WebMux™ Installation
Equipment
IP Address
Internet Router (or Firewall) Address
205.133.156.1
Webserver(s) Default Gateway
205.133.156.1
Web Site IP Address
205.133.156.200
Configuration After WebMux™ Installation
Question
Entry
WebMux
Host Name
Domain Name
NAT, Transparent, or Out-of-Path
Cainetworks.com
Transparent
Bridge Information
Bridge IP Address
Bridge IP Network Mask
WebMux™ farm IP Address
205.133.156.210
255.255.255.0
205.133.156.200
Administration Setup Information
External Gateway IP address
Remake /home/WebMux/conf/passwd
Administration HTTP Port Number
Secure Administration HTTPS Port Number
Is this WebMux™ primary
WebMux™ running solo without backup
205.133.156.1
Y
24
35
Y
Y
Reboot?
Y
Copyright© 1997-2005 CAI Networks, Inc.
71
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Out of Path Installation of WebMux™
Configuration Before WebMux™ Installation
Equipment
IP Address
Internet Router (or Firewall) Address
10.1.1.1
Webserver(s) Default Gateway
10.1.1.1
Web Site IP Address
10.1.1.200/255.255.0.0
Configuration After WebMux™ Installation
Question
Entry
webmux
Host Name
Domain Name
NAT, Transparent, or Out-of-Path
cainetworks.com
Out-of-Path
WebMux™ Server LAN Information
Server LAN WebMux™ IP Address
Server LAN WebMux™ IP Address Mask
Server LAN WebMux™ farm IP Address
Server LAN gateway IP address
10.1.2.254 (any)
255.255.0.0
10.1.1.200
10.1.1.253
(Necessary for WebMux™ SSL termination and for Layer 7 load
balancing. Each server’s default gateway needs to be set to this
IP)
Server Configuration
Server IP address
Server NetMask
Server Default Gateway
Server Default Gateway
No Change
No Change
No Change
10.1.1.253
(if using WebMux™ for SSL Termination or Layer 7 load
balancing)
Server add loopback adapter
Route Deletion Refer to Appendix 2
10.1.1.200
10.1.1.200
Administration Setup Information
WebMux™ External Gateway IP address
Remake /home/WebMux/conf/passwd
Administration HTTP Port Number
Secure Administration HTTPS Port Number
Is this WebMux™ primary
WebMux™ running solo without backup
10.1.1.1
Y
24
35
Y
Y
Reboot?
Y
There is no change to each server’s IP address, netmask and gateway address
(except if using the WebMuxTM for SSL termination or Layer 7 load balancing.
See next paragraph). There is need to add a loopback adapter to each server,
72 Copyright© 1997-2005 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
and assign the farm address to the loopback adapter. For MS Windows, it always
adds a route for the loopback adapter, which will need to be removed, please
refer to Appendix 2. In the virtual farm, each server uses its original IP address to
join the farm.
For SSL termination or Layer 7 load balancing, you must set server LAN gateway
IP address and set the servers’ default gateway to that IP.
Copyright© 1997-2005 CAI Networks, Inc.
73
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
A Redundant Installation
Configuration Before WebMux™ Installation
Equipment
IP Address
Internet Router (or Firewall) Address
205.133.156.1
Webserver(s) Default Gateway
205.133.156.1
Web Site IP Address
205.133.156.200
Configuration Before WebMux™ Installation
Question
Entry
Secondary
Primary
Host Name
webmux1
Domain Name
NAT, Transparent, or Out-of-Path
Cainetworks.com Cainetworks.com
NAT
NAT
webmux2
Router LAN Information
Router LAN WebMux™ Proxy IP
Address
Router LAN Network IP Address Mask
205.133.156.200
205.133.156.200
255.255.255.0
255.255.255.0
Server LAN Information
Server LAN WebMux™ IP Address
Server LAN Gateway IP Address
Server LAN Network IP Address Mask
Server LAN Network IP Address
Server LAN Network Broadcast Address
10.1.1.10
10.1.1.1.1
255.0.0.0
10.0.0.0
10.255.255.255
10.1.1.20
Administration Setup Information
External gateway IP address
Remake /home/WebMux/conf/passwd
Administration HTTP Port Number
Secure Administration HTTPS Port
Is this WebMux™ primary
WebMux™ running solo without backup
205.133.156.1
Y
24
35
Y
N
205.133.156.1
Y
24
35
N
Reboot?
Y
Y
74 Copyright© 1997-2005 CAI Networks, Inc.
255.0.0.0
10.0.0.0
10.255.255.255
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Contact Information
For latest product and support information, please visit our web site at:
http://www.cainetworks.com
To reach us by e-mail:
Support: [email protected]
Sales: [email protected]
To reach us by phone:
Support: 714-550-0901 X2
Copyright© 1997-2005 CAI Networks, Inc.
75
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
FAQs
Q.
R.
I can’t login with my browser. It always says you are not logged into?
To use your browser to manage the WebMux™, it must be set to
accept all cookies. Because the cookie sets expired in 8 hours, you
also need to make sure your hardware clock set correctly using GMT.
The message indicates your system clock off. Please refer to page 67
for how to set the internal clock.
Q.
R.
I can’t login with my browser because the server does not respond?
Your IP address is not on the allowed host list, or the wrong IP
addresses were entered by accident. Using front push button to clear
that list.
Q
If I have multiple servers assigned as STANDBY, how does the
WebMux™ choose which server to use if an ACTIVE server goes
down?
The WebMux™ checks the standby servers in order and activates
each one until their total weight meets or exceeds the server that is
unavailable
R
Q.
R.
Will a server with weight 0 act as a STANDBY?
No. A weight of 0 indicates that the server will not accept any new
connections. The state is considered neither ACTIVE nor STANDBY.
This is to quiet the new connections for the server so that it can be
taken out of service.
Q.
Is the Server LAN and the Router or Front LAN required to be on
separate IP subnets?
It is required that the server LAN and the router LAN be separate IP
subnets.
R.
Q.
R.
What notification services are compatible with the WebMux™?
Airtouch and PageMart are the services that are currently supported.
Any SMTP server can be used for sending email notifications.
Q.
If I’m running a Unix-based FTP, such as wuftp, how can I get the ftp
server in the farm to resolve the WebMux™ IP addresses?
The IP addresses typically will not be able to be resolved since the
servers in the farm are typically using non-routable or private network
addresses. In order for wuftp to resolve the IP addresses and stop
complaining, place the non-routable IP address entries in the /etc/hosts
file on those servers.
R.
76 Copyright© 1997-2005 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Q.
R.
Q.
R.
Q.
R.
Q.
R.
Q.
R.
Q.
R.
How come my servers in the farm showing in red color from time to
time, even the servers are okay?
Your servers are trying to resolve WebMux’s IP address to name so it
could log them into log file. To avoid this problem, set the servers not
resolve the IP addresses, also adding all the IP address to the
/etc/hosts file on your servers. For example,
www.mydomain.com 1.2.3.4
// use your real IP address
webmuxgw
192.168.199.1
// server lan gateway
webmuxip
192.168.199.254 // server lan WebMux™
How many browsers can simultaneously access the WebMux™
management console?
The limit is 4.
I have added a new farm/server, but the changes are not showing up
on the STATUS screen.
The web browser caching pages may cause this. If the new
configuration does not appear after clicking on Reload or Refresh, then
clear the cache or temporary files on the browser.
Will my web server be able to communicate to a credit card validation
service, like Cybercash?
Yes. Any communication initiated from the internal or private network,
the WebMux™ will substitute the IP address of its router LAN interface
for the IP address of the host initiating the conversation. Any service
that requires a specific IP address to allow communication into their
network, the IP address of the router LAN interface must be the one
provided. We have CyberCash engineers worked with us to test this is
working fine.
Can I use the WebMux™ as a proxy server for other hosts in my
internal network?
Yes. The function that allows the web servers to talk to services such
as the credit card validation, allows the WebMux™ to function as a
proxy server for any host in the internal network. The WebMux™ will
translate all internal addresses to the IP address of the “first farm”
defined. This is the farm that is created when answering the question:
Enter Router LAN WebMux™ proxy IP address:.
Configuring other computers using WebMux’s proxy function is easy –
just point the gateway IP address to the WebMux™ backend IP
address.
Do I need to have a firewall in front of WebMux™?
In most cases, no. WebMux™ blocks all the incoming traffic from
router LAN to your internal network. Unless there is a farm defined for
a port number, the outside traffic will not be able to reach to any server
Copyright© 1997-2005 CAI Networks, Inc.
77
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
or computers behind WebMux™. WebMux™ does not have the
management functionality for restricting which IP address or services
an internal host can reach to the outside. If such restriction is
desirable, then additional firewall is needed.
Q.
R.
What can I do if the service that I want to load balance is not in the list?
WebMux™ as is already supports many different services. In the case
if your service is not in the list, you could use generic TCP and/or UDP
to set your farm. If that is still not good enough, you may contact us for
developing a special service aware module for you. In most cases,
there is a very reasonable fee to be charged.
Q
Why secondary WebMux™ did not take over when I powered down
Primary WebMux™?
1) Two WebMux™ not on the same version of firmware. Or 2)
Secondary WebMux™ monitors primary WebMux™ as well as few
other things. Before it takes over, it makes sure it can reach to the
router LAN gateway, as well as at least one server defined in any farm.
If secondary WebMux™ cannot reach to the front router LAN gateway,
or it cannot see any server in any farm, then it will consider the primary
disconnect or power down was done purposely by operator.
R
Q
R
Why my FastIron Switch set to 100MB fix speed does not work with
WebMux™?
WebMux ™ uses Intel network chipsets internally. Intel chipsets
follows all industrial standards and have good performance and
reliability. However, we did discovered some of the Foundry Networks
switches does not negotiate with Intel chipsets well. To make them
work together, one will need to set the switch to “auto negotiation” on
speed, instead of fixed 100. They will communicate each other at
100BT or 1000BT (Pro version only).
78 Copyright© 1997-2005 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Regulations
Notice to the USA
Compliance Information Statement (Declaration of Conformity
Procedure) DoC FCC Part 15: This device complies with part 15
of the FCC Rules.
Operation is subject to the following conditions:
1) This device may not cause harmful interference, and
2) This device must accept any interference received including
interference that may cause undesired operation. If this equipment
does cause harmful interference to radio or television reception,
which can be determined by turning the equipment off and on, the
user is encouraged to try one or more of the following measures:
Reorient or relocate the receiving antenna.
Increase the separation between the equipment and the
receiver.
Plug the equipment into an outlet on a circuit different from
that of the receiver.
Consult the dealer or an experienced radio/television
technician for help.
Notice for Canada
This apparatus complies with the Class B limits for radio interference as specified
in the Canadian Department of Communications Radio
Interference Regulations. (Cet appareil est conforme aux
norms de Classe B d’interference radio tel que specifie par
le Ministere Canadien des Communications dans les
reglements d’ineteference radio.)
Notice for Europe (CE Mark)
This product is in conformity with the Council Directive
89/336/EEC, 92/31/EEC (EMC).
Caution: Lithium battery included with this device. Do not puncture, mutilate, or
dispose of batter in fire. Danger of explosion if battery is incorrectly replaced.
Replace only with the same or equivalent type recommended by manufacture.
Dispose of used Battery according to manufacture instruction and in accordance
with your local regulations.
Copyright© 1997-2005 CAI Networks, Inc.
79
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Appendix 1 – How to Add A Loopback Adapter
For out-of-path mode, a loopback adapter or device in similar function is required.
This appendix listed a few different ways to add such a device for different OSes.
Installing the MS Loopback Adapter
1. Click Add Hardware -> Add a new device -> No, I want to select
the hardware from a list, and select Microsoft Loopback Adapter
from the list and click OK.
2. At the MS Loopback Adapter Card Setup screen hit OK to the
default of 802.3
3. You should be prompted for the path to the NT setup files. Click
Continue once the path is correct.
4. Click Close. Reboot maybe necessary. Go to step below for
Configuring the MS Loopback Adapter
Configuring the MS Loopback Adapter
1. If not there already, goto Start > Settings > Control Panel >
Network > Protocols tab.
2. Select TCP/IP and click the Properties button
3. You should be at the Microsoft TCP/IP Properties dialog box. Be
sure the MS Loopback Adapter is the Adapter selected. Enter
your farm IP address for IP address (Subnet should be match your
servers, change it if not)
4. Click Apply, then OK, then Yes when prompted to restart the
computer
For Windows 2003 Server, make sure the metric is the highest number in routing
table, stop here. For Windows 2000/NT Systems, please proceed to the
Appendix 2 for remove the route entry in the routing table. For Linux, HP/UX, and
FreeBSD perform the following:
For Linux 2.4/2.6 Systems:
Login as root, and add this command to the bootup script:
iptables -t nat -A PREROUTING -d <farm_ip> -j DNAT --to-dest <server_ip>
For IP-based virtual hosting with multiple IPs, repeat the command for each farm
IP on all the servers. Don’t forget to add the proper farm IP to each virtual host
configuration.
80 Copyright© 1997-2005 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
For SUSE Enterprise Linux 9:
You can use YAST to set up a Virtual Interface and add the farm IP.
Login as root, and add this command to the bootup script:
iptables -t nat -A PREROUTING -d <farm_ip> -j DNAT --to-dest <server_ip>
For HP/UX 11.00 and 11i:
Please make sure PHNE_26771 and related patches applied first.
Login as root, and add this command to the bootup script:
ifconfig lo0:1 farm_ip_address up
For FreeBSD:
ifconfig lo0 inet farm_ip_address netmask 255.255.255.255 alias
For Solaris:
ifconfig lo0:1 FARM_IP_ADDR
ifconfig lo0:1 FARM_IP_ADDR FARM_IP_ADDR
ifconfig lo0:1 netmask 255.255.255.255
ifconfig lo0:1 up
For Apple Servers:
ifconfig lo0 inet farm_ip_addr netmask 255.255.255.255 alias
route delete gateway_ip farm_ip_addr netmask
Where lo0 is the loopback adapter.
Copyright© 1997-2005 CAI Networks, Inc.
81
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Appendix 2 - How to make route delete reboot persistent
1. In a Windows system, go to boot drive root by cd C:\;
2. Use a text editor to create a text file, in which it contains one line:
route delete 10.1.0.0 mask 255.255.0.0 10.1.1.200
3. In above file 10.1.0.0 is the network destination, 255.255.0.0 is the
Netmask for the network, and 10.1.1.200 is the farm address, also
is the address for the loopback adapter address.
4. start Scheduled Task in control panel;
5. Click "add Scheduled Task"; then next;
6. "Browse" to the .bat file we created -- like WebMux.bat under c:\ ;
7. Choose "Perform this task" -- "when my computer starts”.
That will delete the route every time the Windows computer reboots. Please
make sure after “route delete” the only route left in the routing table for the
loopback adapter is this one (your actual IP address and netmask maybe
different):
10.1.1.255
255.255.255.255 10.1.1.200
10.1.1.200
1
All other routes for the loopback adapter must not show in the routing table. On
both Windows and Unix, routing table can be seen by execute this command:
“netstat –rn” .
Please note for Windows 2003 servers, the route for the loopback adapter can
not be deleted. However, since Windows 2003 server automatically taking a
highest metric number, the route does not need to be deleted.
82 Copyright© 1997-2005 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Appendix 3
- Phone Paging Codes
When an error occurs, the WebMux™ will send an error code to the regular
numerical pager assigned in the Administration Setup page. Please refer to the
Management Browser - Administration Setup section on setting up phone pager
numbers.
To be as compatible as possible to different types of pagers, only numeric error
codes are used. The minimum requirement is the pager should be able to
display up to 18 digits. If the pager cannot display 18 digits, some codes may get
truncated.
For WebMux™ (Single and with Secondary)
•
99IIIIIIIIIIIIPPPP - A server went down. This 18-digit code (no spaces)
starts with 99 followed by 12 digits of the IP address (without the periods)
of the server. The last four digits represent the port number of the server.
•
00IIIIIIIIIIIIPPPP - A downed server went back up. This 18-digit code (no
spaces) starts with 00 followed by 12 digits of the IP address (without the
periods) of the server. The last four digits represent the port number of
the server.
•
98////////////[PPPP] – Gateway (router LAN) does not respond. 12 digits
number after the 98 is the IP address of the gateway. Port number is
optional.
•
01////////////[PPPP] – Gateway comes back in service. 12 digits number
after the 01 is the IP address of the gateway. Port number is optional.
•
88////////////PPPP – WebMux™ has detected more connections than the
threshold defined in the setup screen.
•
40 - last resort servers taken out of service for a farm.
•
41 - last resort servers put in service for a farm.
•
73 - WebMux™ cannot reach to the back LAN.
•
74 - WebMux™ cannot reach the front LAN.
•
75 - Primary or Secondary cannot reach the other WebMux™ through
the serial cable.
•
76 - Serial cable communication restored.
•
55 - User configuration cannot be parsed by WebMux™ (after the
configuration restored through browser).
Copyright© 1997-2005 CAI Networks, Inc.
83
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
For WebMux™ Primary Only
•
66 - Secondary is not responding.
For WebMux™ Secondary Only
•
71 - Primary failed. Secondary took over from Primary.
•
72 - Primary went back up. Control returns to the Primary.
84 Copyright© 1997-2005 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Appendix 4 – Virtual Hosting Issues
Servers serving more than one web site may do virtual hosting. The WebMux™
supports virtual hosting by checking the virtual server’s response. There are
three different situations for the WebMux™ to handle.
If the service is HTTPS, there is no way to do virtual hosting on the same IP
address. However, each HTTPS farm can be on a different IP address on the
same server. The reason that each HTTPS server must have its own IP address
is that any web server software, IIS or Apache, can not see the URL in the
HTTPS packets, since they are encrypted. The IIS or Apache server only
decrypts the URL after the packet is sent to a particular process. Since no web
server software supports virtual hosting HTTPS on the same IP address, the
WebMux™ does not need to do anything extra other than load balancing all the
packets for that particular farm.
If the service is HTTP, then any web server software, IIS or Apache, can host
almost unlimited virtual farms on each IP address. Many hosting centers handle
this situation by putting all the servers serving each virtual host on a server farm
on the WebMux™. The WebMux™ will load balance the traffic for all the
incoming traffic for that IP address to different servers in that farm. During farm
setup, the label for the farm could be one of the virtual farm’s base URL, say
www.mydomain.com , the WebMux™ actually periodically reads a page from this
URL. If server that serves that URL does not response correctly, the WebMux™
will mark that server dead. Since every server in that farm serves all the virtual
farms, the WebMux™ expects the problem with one server in one URL will affect
all the URLs in that farm.
Another situation is the server that serves HTTP virtual sites using a single
private IP address already before load balancing. After adding load balancer,
some the sites want to have their own IP addresses. The WebMux™ allows set
up separate farm for each site having its own public IP address, but point to the
same sets of servers in the private network. In this situation, each separate farm
could have its own label as www.site1.com and www.site2.com, etc. The
WebMux™ will actually do health check on each URL by periodically read a
default page from that site.
In the virtual hosting situation, the label and response from the web servers are
critical for reliable services. The WebMux™ checks the label and checks the
server for its health situation based on the URL supplied in the label. If the
server response is 500 or greater, which is an error code indicating server
internal error, the WebMux™ will excludes that server from serving the farm. If
server responses 402, which indicating access is denied for that virtual farm, the
WebMux™ will mark that server dead. We have checked with IIS server and
Apache server, they both follow the same rules.
Copyright© 1997-2005 CAI Networks, Inc.
85
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Appendix 5 – Sample Custom CGI Code
The custom cgi-bin checking program may be written in Java, VB, C, or Perl, for
example, or it may be a WB or shell script. Here is sample script written for the
linux shell bash which sees if an SSH daemon is running as its check criterion.
#!/bin/bash
echo "Content-type: text/plain"
echo
# blank line
if ps -C sshd &>/dev/null ; then
echo "OK"
# response from server goes here, see list below.
echo "SSH service available"
else
echo "NOT OK"
echo "SSH daemon not running"
fi
The following is a list of valid CGI code responses:
OK
OVERLOAD
QUIESCE
WEIGHT=n
WEIGHT-=n
WEIGHT+=n
- server is alive, no weight change
- set weight to 0, to quiesce (same as “WEIGHT=0”)
- set weight to 0, to quiesce (same as “WEIGHT=0”)
- set weight to integer n
- subtract integer n from the weight
- add integer n to the weight
The response must be in all capitals to be recognized. The changes in weight
count as an unsaved configuration change. It is not automatically saved.
86 Copyright© 1997-2005 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Appendix 6 – Access CLI Commands
Once the diagnose ports set, superuser could use ssh or telnet to access the CLI
commands to help troubleshoot network problems or server problems. There are
maximum two diagnose ports. The first one will be SSH and second one will be
Telnet. If there is only one port specified, only SSH access is allowed.
“ssh –l superuser –p port_number WebMux_ip_address”
Can be issued from any Linux/Unix computer. For Windows computer, PuTTY
can be freely downloaded over Internet.
Once login into CLI, following screen will be shown:
Enter "help" for list of commands.
Enter “cmd --help" give help for the command "cmd".
Enter "exit" or "logout" to end this session.
Following are commands available in CLI:
arp - manipulate the system ARP cache
arping - ping <address> on device <interface> by ARP packets, using source
address <source>.
factory_reset – reset WebMux™ settings to original settings, clear all current
setting.
getallsettings - save all WebMux™ settings from WebMux™ to your PC
getconfig – save all farm/server settings from WebMux™ to your PC
ifconfig – display and configure a network interface(s)
netstat – display network connections, routing tables, interface statistics, etc.
ping - send ICMP ECHO_REQUEST packets to network hosts
putconfig - restore farm/server settings from your PC to WebMux™
rec_cmdline – allowing configure basic WebMux™ IP without using pushbutton.
tcpdump – capture and display network traffic
traceroute - print the route packets take to network host
Most commands can be found on Unix, for detailed usage, please refer to any
Unix man pages. Our support center does not support the usage of these
commands.
Copyright© 1997-2005 CAI Networks, Inc.
87
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Appendix 7 – Extended Regular Expressions
Example Patterns:
An item which has the string "Compiler" in it.
Compiler
Items with various spellings of "Dijkstra" with the j replaced by any character
Di.kstra
Items with various spellings of "Dijkstra" with the "ijk" replaced by any number of
characters
D.*stra
An item with either "Compiler" or "compiler" in it.
[cC]ompiler
String like bananas, banananas, bananananas etc.
bana(na)+s
Items with the strings "regular" and "expression" on the same line with anything
or nothing between them
regular.*expression
Items with either regular or expression (or both).
regular|expression
Items with either OO or "Object Oriented" or “Object-Oriented” on one line.
OO|([oO]bject( |\-)[oO]riented)
To search for characters other than letters or digits put a "\" in front of them.
S\/SL
These examples were taken from the following web page:
http://www.csci.csusb.edu/dick/samples/egrep.html
88 Copyright© 1997-2005 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
Index
1
128bit · 49
A
ACTIVE · 61, 74
Add · 30, 33, 36, 46, 54, 58, 60, 62, 63, 68, 78
Allowed · 27, 29, 35, See
arp · 38, 85
C
certificate · 50, 56
Compliance · 77
cookie expire · 57
cookies · 4, 5, 31, 57, 59, 62, 74
CSR · 50
Custom Defined · 56, 57
D
Default Gateway · 10, 13, 23, 67, 68, 69, 70, 72
diagnostic ports · 37
Download · 34, 52
E
email notification · 4, 36
expire · 51, 57
F
farm · 7, 8, 11, 13, 14, 18, 19, 22, 27, 34, 40, 41, 54, 55, 56, 57, 58, 59, 60, 61, 68, 69, 70, 71, 74, 75, 76, 78, 80
fault tolerance · 3
Firewall · 4, 67, 68, 69, 70, 72
G
gateway · 11, 13, 14, 22, 23, 25, 26, 34, 37, 41, 47, 68, 70, 72, 75, 76, 79, 81
generate · 49, 50
H
Hardware Setup · 19, 20
Copyright© 1997-2005 CAI Networks, Inc.
89
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
health check · 3, 40, 56
L
loopback · 14, 25, 70, 80
Loopback · 78
M
management console · 27, 29, 30, 35, 37, 75
Modify · 30, 58, 63
N
NAT · 4, 7, 20, 21, 22, 23, 26, See
netmask · 10, 36, 70
NTP · 41, 44, 56
O
out-of-path · 14, 47, 78
Out-of-Path · 4, 7, 8, 14, 15, 16, 21, 25, 26, 40
OVERLOAD · 84
Overview · 3, 7
P
pager · 4, 34, 36, 81
paging · 36
passwd · 27, 67, 68, 69, 70, 72
persistent · 38, 40, 57, 58, 59, 80
PIN · 43
primary · 12
Proxy · 3, 22, 67, 68, 69, 72
public key · 49, 50
R
Reboot · 20, 28, 41, 67, 68, 69, 70, 72, 78
Round-Robin · 5
route · 15, 26, 38, 55, 71, 78, 80, 85
Router LAN · 2, 7, 10, 11, 12, 13, 19, 20, 21, 22, 67, 68, 69, 72, 75
S
scheduling · 57, 58
secondary · 12
Server LAN · 2, 7, 10, 11, 12, 13, 19, 22, 23, 25, 67, 68, 70, 72, 74
Spanning Tree Protocol · 17
SSL · 3, 5, 6, 26, 46, 48, 56
STP · 17
superuser · 32, 35
90 Copyright© 1997-2005 CAI Networks, Inc.
The WebMux™ Model 481S, 591SG, and 680PG User Guide – Version 8.1.x
syslogd · 36
T
timeout · 33, 34, 36, 40
Timeout · 34, 40
TLS · 48
Transparent · i, ii, 4, 7, 16, 20, 21, 26, 55, 67, 68, 69, 70, 72
U
Upload · 34, 52
URL · 31, 40, 56, 65, 83
V
version · 20, 41, 55, 60, 76
Virtual Farm · 7, 18
W
weight · 40, 61, 63, 74, 84
Copyright© 1997-2005 CAI Networks, Inc.
91